fix: bump @orpc/* to ^1.14.6 to patch prototype pollution (CVE-2026-28794)#192
Open
dj-exo wants to merge 1 commit into
Open
fix: bump @orpc/* to ^1.14.6 to patch prototype pollution (CVE-2026-28794)#192dj-exo wants to merge 1 commit into
dj-exo wants to merge 1 commit into
Conversation
CVE-2026-28794 (CVSS 9.8, Critical) is a prototype-pollution vulnerability in @orpc/client's StandardRPCJsonSerializer deserialization, fixed upstream in @orpc/client 1.13.6. Previously @orpc/client and @orpc/contract were pinned to the EXACT vulnerable version 1.13.4 (in the root package.json devDependencies and in packages/plugin-obsessiondb). Because the pin was exact, downstream consumers could not receive the patched release without forcing a pnpm/npm override. Loosening these to the caret range ^1.14.6 (a safe, well-aged target within the internally version-locked @orpc/* family) lets consumers pick up the patched release and future patches automatically. Lockfile regenerated with bun; @orpc/* now resolves to 1.14.8. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Loosens and bumps the exact-pinned
@orpc/clientand@orpc/contractdependencies from the vulnerable1.13.4to the caret range^1.14.6, so consumers can receive the patched@orpc/clientrelease (>= 1.13.6) without needing package-manager overrides.Root cause
@orpc/client< 1.13.6is affected by CVE-2026-28794 (CVSS 9.8, Critical): prototype pollution viaStandardRPCJsonSerializerdeserialization.Both the root
package.json(devDependencies) andpackages/plugin-obsessiondb/package.jsonpinned@orpc/clientand@orpc/contractto the exact version1.13.4. Because the@orpc/*family is internally version-locked (each package pins its siblings to the same exact version) and the pin here was exact, downstream consumers of@chkit/plugin-obsessiondbcould not pull in the patched release without forcing apnpm/npmoverride in their own projects.Fix
packages/plugin-obsessiondb/package.json:@orpc/clientand@orpc/contract1.13.4->^1.14.6package.json(root devDependencies):@orpc/clientand@orpc/contract1.13.4->^1.14.6bun.lock(bun install);@orpc/*now resolves to1.14.8, which is well-aged and contains the fix.^1.14.6is used (rather than an exact pin) so future patches within the@orpc/*family flow to consumers automatically.References
Test plan
bun installsucceeds and lockfile resolves@orpc/*to>= 1.13.6(verified locally:1.14.8)bun run build/turbo run buildpassesbun test/ package test suites pass@chkit/plugin-obsessiondbruntime behavior against ObsessionDB is unaffected by the1.13.4 -> 1.14.xbumpMade with Cursor